Skip to content

deps(deps): bump the runtime-dependencies group with 5 updates - #27

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/runtime-dependencies-49ea88e622
Open

deps(deps): bump the runtime-dependencies group with 5 updates#27
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/runtime-dependencies-49ea88e622

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown

Bumps the runtime-dependencies group with 5 updates:

Package From To
pyyaml 6.0.2 6.0.3
jsonschema 4.23.0 4.26.0
rich 13.7.1 15.0.0
networkx 3.4.2 3.6.1
urllib3 2.3.0 2.7.0

Updates pyyaml from 6.0.2 to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

  • Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

  • yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)
Commits

Updates jsonschema from 4.23.0 to 4.26.0

Release notes

Sourced from jsonschema's releases.

v4.26.0

What's Changed

New Contributors

Full Changelog: python-jsonschema/jsonschema@v4.25.1...v4.26.0

v4.25.1

What's Changed

... (truncated)

Changelog

Sourced from jsonschema's changelog.

v4.26.0

  • Decrease import time by delaying importing of urllib.request (#1416).

v4.25.1

  • Fix an incorrect required argument in the Validator protocol's type annotations (#1396).

v4.25.0

  • Add support for the iri and iri-reference formats to the format-nongpl extra via the MIT-licensed rfc3987-syntax. They were alread supported by the format extra. (#1388).

v4.24.1

  • Properly escape segments in ValidationError.json_path (#139).

v4.24.0

  • Fix improper handling of unevaluatedProperties in the presence of additionalProperties (#1351).
  • Support for Python 3.8 has been dropped, as it is end-of-life.
Commits
  • a727743 Add a changelog entry for 4.26.
  • 6d28c13 Update the lockfile.
  • 739499e Update pre-commit hooks.
  • cb2d779 Merge pull request #1443 from python-jsonschema/pre-commit-ci-update-config
  • e6bbbb7 [pre-commit.ci] pre-commit autoupdate
  • d56037a Merge pull request #1442 from python-jsonschema/dependabot/github_actions/ast...
  • e54ce13 Bump astral-sh/setup-uv from 7.1.4 to 7.1.6
  • 1f7c9fb Partially update docs requirements.
  • 241aec9 Merge pull request #1441 from python-jsonschema/pre-commit-ci-update-config
  • 2818efb Apache-2.0 -> nongpl
  • Additional commits viewable in compare view

Updates rich from 13.7.1 to 15.0.0

Release notes

Sourced from rich's releases.

The So Long 3.8 Release

A few fixes. The major version bump is to honor the passing of 3.8 support which reached its EOL in October 7, 2024

[15.0.0] - 2026-04-12

Changed

  • Breaking change: Dropped support for Python3.8

Fixed

The Faster Startup Release

No new features in this release, but there should be improved startup time for Rich apps, and potentially improved runtime if you have a lot of links.

[14.3.4] - 2026-04-11

Changed

The infinite Release

Fixed a infinite loop in split_graphemes

[14.3.3] - 2026-02-19

Fixed

The ZWJy release

A fix for cell_len edge cases

[14.3.2] - 2026-02-01

Fixed

The Nerdy Fix release

Fixed issue with characters outside of unicode range reporting 0 cell size

[14.3.1] - 2026-01-24

... (truncated)

Changelog

Sourced from rich's changelog.

[15.0.0] - 2026-04-12

Changed

  • Breaking change: Dropped support for Python3.8

Fixed

[14.3.4] - 2026-04-11

Changed

[14.3.3] - 2026-02-19

Fixed

[14.3.2] - 2026-02-01

Fixed

[14.3.1] - 2026-01-24

Fixed

[14.3.0] - 2026-01-24

Fixed

Added

... (truncated)

Commits

Updates networkx from 3.4.2 to 3.6.1

Release notes

Sourced from networkx's releases.

NetworkX 3.6.1

networkx 3.6.1

We're happy to announce the release of networkx 3.6.1!

API Changes

  • Add spectral bipartition community finding and greedy bipartition using node swaps (#8347).

Enhancements

  • Nodelists for from_biadjacency_matrix (#7993).
  • Add spectral bipartition community finding and greedy bipartition using node swaps (#8347).
  • Fix draw_networkx_nodes with list node_shape and add regression test (#8363).

Bug Fixes

  • Fix: allow graph subclasses to have additional arguments (#8369).

Documentation

  • DOC: Improve benchmarking readme (#8358).
  • DOC: More details re: RC releases in the release process devdocs (#8346).
  • DOC: clarify difference between G.nodes/G.nodes() and G.edges/G.edges() in tutorial (#8300).
  • DOC: Add blurb to contributor guide about drawing tests (#8370).
  • DOC: Fix underline lens in docstrings (#8371).
  • Rolling back shortest paths links (#8373).

Maintenance

  • MAINT: Replace string literal with comment (#8359).
  • Bump actions/checkout from 5 to 6 in the actions group (#8360).
  • pin python 3.14 to be version 3.14.0 until dataclasses are fixed (#8365).
  • Blocklist Python 3.14.1 (#8372).

Other

  • TST: add tests for unsupported graph types in MST algorithms (#8353).
  • TST: clean up isomorphism tests (#8364).

Contributors

10 authors added to this release (alphabetically):

... (truncated)

Commits
  • 7530809 Designate 3.6.1 release
  • 4788eb0 Rolling back shortest paths links (#8373)
  • 696edb6 Fix draw_networkx_nodes with list node_shape and add regression test (#8363)
  • c38830c Blocklist Python 3.14.1 (#8372)
  • 81d2311 DOC: Fix underline lens in docstrings. (#8371)
  • a6e2bfa DOC: Add blurb to contributor guide about drawing tests. (#8370)
  • 96b6282 DOC: clarify difference between G.nodes/G.nodes() and G.edges/G.edges() in tu...
  • 75bdd73 Fix: allow graph subclasses to have additional arguments (#8369)
  • 7663fa5 TST: clean up isomorphism tests (#8364)
  • 3dacd1b Add spectral bipartition community finding and greedy bipartition using node ...
  • Additional commits viewable in compare view

Updates urllib3 from 2.3.0 to 2.7.0

Release notes

Sourced from urllib3's releases.

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

  • Decompression-bomb safeguards of the streaming API were bypassed:

    1. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @​Cycloctane)
    2. During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @​kimkou2024)

    See GHSA-mf9v-mfxr-j63j for details.

  • HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @​christos-spearbit)

Deprecations and Removals

  • Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)
  • Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)
  • Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)
  • Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

  • Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)
  • Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)
  • Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)
  • Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)
  • Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)
  • Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)

2.6.3

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

2.6.2

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

  • Decompression-bomb safeguards of the streaming API were bypassed:

    1. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.
    2. During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

    See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

  • HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

  • Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)
  • Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)
  • Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)
  • Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

  • Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)
  • Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(deps): bump the runtime-dependencies group with 5 updates
b253fa0 
Bumps the runtime-dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [pyyaml](https://github.com/yaml/pyyaml) | `6.0.2` | `6.0.3` |
| [jsonschema](https://github.com/python-jsonschema/jsonschema) | `4.23.0` | `4.26.0` |
| [rich](https://github.com/Textualize/rich) | `13.7.1` | `15.0.0` |
| [networkx](https://github.com/networkx/networkx) | `3.4.2` | `3.6.1` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |


Updates `pyyaml` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/6.0.3/CHANGES)
- [Commits](yaml/pyyaml@6.0.2...6.0.3)

Updates `jsonschema` from 4.23.0 to 4.26.0
- [Release notes](https://github.com/python-jsonschema/jsonschema/releases)
- [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst)
- [Commits](python-jsonschema/jsonschema@v4.23.0...v4.26.0)

Updates `rich` from 13.7.1 to 15.0.0
- [Release notes](https://github.com/Textualize/rich/releases)
- [Changelog](https://github.com/Textualize/rich/blob/main/CHANGELOG.md)
- [Commits](Textualize/rich@v13.7.1...v15.0.0)

Updates `networkx` from 3.4.2 to 3.6.1
- [Release notes](https://github.com/networkx/networkx/releases)
- [Commits](networkx/networkx@networkx-3.4.2...networkx-3.6.1)

Updates `urllib3` from 2.3.0 to 2.7.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.3.0...2.7.0)

---
updated-dependencies:
- dependency-name: pyyaml
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: jsonschema
  dependency-version: 4.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: rich
  dependency-version: 15.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: runtime-dependencies
- dependency-name: networkx
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: urllib3
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from nullc0d30 as a code owner August 17, 2026 09:27
@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
pip/jsonschema 4.26.0 UnknownUnknown
pip/networkx 3.6.1 UnknownUnknown
pip/pyyaml 6.0.3 UnknownUnknown
pip/rich 15.0.0 UnknownUnknown
pip/urllib3 2.7.0 UnknownUnknown

Scanned Files

  • requirements.txt

@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown

Quality Gates Summary

Blocked: true
Passed: 8 / Failed: 6 / Errors: 0 / Skipped: 0

  • [PASS] ruff — ruff check clean
  • [FAIL] mypy — mypy type errors found
  • [FAIL] pytest — pytest failures
  • [PASS] coverage — coverage 80.1% (threshold 80.0%)
  • [FAIL] architecture — architecture violations
  • [PASS] deadcode — no dead code detected
  • [PASS] dependencies — no known vulnerabilities
  • [PASS] docs — 7/7 documentation checks passed
  • [FAIL] security-pipeline — 1 scanner(s) reported findings
  • [FAIL] performance — 2 slow test(s) beyond 20s
  • [FAIL] compliance — pip-licenses scan
  • [PASS] hygiene — repository hygiene checks passed
  • [PASS] packaging — packaging validated: 2 artifacts, all checks passed
  • [PASS] git-diff — working tree clean

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nullc0d30 nullc0d30 Awaiting requested review from nullc0d30 nullc0d30 is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants